HIPAA and PHI Policy

Request a BAA

Use the request form to tell us about your intended sources and workflow, or email legal@zentrik.ai.

Our role

Zentrik supports product work. It is not a system of record for patient data. Where a customer is a covered entity or a business associate, Zentrik acts as a business associate or as a subcontractor. Zentrik is not a covered entity and does not hold a designated record set. The executed BAA defines our obligations.

Where PHI can reach Zentrik

PHI reaches Zentrik only through sources a customer deliberately connects or uploads. In practice that means:

• Support desk tickets imported from a connected help desk, including public comment text.
• Meeting and research recordings imported from a connected notetaker.
• Documents and context a customer adds to a workspace.
• Text a customer types or dictates into the product.

Zentrik does not fetch help desk attachments or inline images, and private and internal notes are excluded from analysis. Before analysis, ticket descriptions, comments and transcripts pass through automated redaction of identifiers such as email addresses, phone numbers and card numbers. Redaction reduces exposure. It is not de-identification.

Configuring a workspace for PHI

Configuration is work we perform with the customer before a PHI-bearing source is enabled. It covers:

• Confirming which sources are in scope, and narrowing the import to the fields and groups required.
• Turning off public web research, and agreeing not to use the rest of the functionality listed under Outside the BAA.
• Confirming that every sub-processor able to receive workspace content is itself under a BAA. The current list is on the Sub-processors page.
• Agreeing retention and deletion expectations for the content the source will carry.

Outside the BAA

Some functionality sends content to providers that are not covered by our BAA chain. PHI should not be entered into them:

• Sending a prototype specification to an external build tool that the customer connects.
• Public web research. A workspace configured for PHI turns it off.
• Email digests with record details included.
• Any source or integration that has not been scoped with us as part of the configuration above.

Functionality not listed as excluded is not automatically in scope. Scope is set by the executed BAA and the HIPAA Guide referenced in it.

Customer responsibilities

Customers decide what enters the Service. Before enabling a PHI-bearing source, assess whether the configuration is appropriate for the use case, limit workspace membership to people who need access, and apply the minimum necessary standard to the scope of the import. Shared links and exports carry whatever the underlying record contains.

Reporting and contact

Report a suspected disclosure of PHI to security@zentrik.ai. For the BAA, the HIPAA Guide, or a security questionnaire, contact legal@zentrik.ai.